c82eea715a6707cfb15da3e0d04341f53ac7eb20de6b198d79489ef00fb306f5

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Size 376KB
Sample260804-legqpswgph
SHA256 c82eea715a6707cfb15da3e0d04341f53ac7eb20de6b198d79489ef00fb306f5
MD5 d916c8e0c421b5d3dadf616e8fc37808
SHA1 291981eba03bde37b44133dfd7c07a9827301bb6
SHA512 f4f47ba0a1d08ed2847f4e00f5261bb78a9534934246c7ef6bbd0fa8cac2fa468364236a9bd9eaa1857c2732d90be70d6310f14e1a3b6f225fe32978d21a98bd
SSDEEP 6144:N+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarw+:dYCDi50NiQOuysMFZzN/E/msup7s/
TLSH
T15E848C06F75408F9D59BC57489924546DA39BC8F1B72EAEF17C8422A2F237F08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

persistence

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5e3-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c00000001c5e5-12.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/5416-17-0x0000000000900000-0x0000000000916000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 1 IoCs

pid	Process
5416	audiodg.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 5416	4216	2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_d916c8e0c421b5d3dadf616e8fc37808_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\Documents\diagnostics\audiodg.exe
  "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
  2⤵
  - Executes dropped EXE
  PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

audiodg.exe

Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
Size 62KB
SHA256 b5265ebf73fedc1d0333fd4f72c7021eef1cd8b948b4e41969cdb2a3ef6bd35d
MD5 83e0bdc6f86ef6d0c1d991f2b737ed19
SHA1 52677f99fc860a5b9f2b29f3e536ff2ba168101f
SHA512 4c298729be4e77edd165a5c52be40f022763a479777be1ae55809c8158649f3159c6369649e5407140b7dc9b111b8cc67c611fdedb0990b2d9f1c083068b6f11
SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAVecYpbExJO1EA+Bdd:QE/msHasdDOFHbAMbExJO1Ebdd
TLSH
T1E6536C18BBE60125E5BF6FB158F53266DB39F6635903D62F28C602871A23E85CD006FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shost.exe

Path C:\Users\Admin\Documents\diagnostics\shost.exe
Size 375KB
SHA256 4fe8750c009f450abf9cc47f7e47f30ead15e56142f23b6daaa42c846cf34b27
MD5 0c5927f5eb1d6d8fba333bb9e9a88121
SHA1 d35127a9d51661a3a4eaae2a2a97813e6df17159
SHA512 ddfc0222da8122e864d5c39526d2723fea343e0b21e943173bc2ff922b34870a0cae48b77fffb0526cfe35bdb24bbbea173ef0fbadc78aa8af292ccc2ced0428
SSDEEP 6144:N+GYnA0zeW8Di50JziQ81d3f+RysMFZzN/E/msHOtbSiqNsarwA:dYCDi50NiQOuysMFZzN/E/msup7st
TLSH
T117847C06F75408F9D59BC57489924546DA39BC8F1B72EAEF17C8422A2F237F08E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5416-16-0x00007FFD5EB3F000-0x00007FFD5EB40000-memory.dmp

Download

memory/5416-17-0x0000000000900000-0x0000000000916000-memory.dmp

Download

memory/5416-18-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

memory/5416-19-0x00007FFD5E9B0000-0x00007FFD5F354000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads